linux-keepalived

Keepalived
Keepalived在这里主要用作RealServer的健康状态检查以及LoadBalance主机和BackUP主机之间failover的实现 。IPVS通常与keepalived配合使用，后者也是LVS项目的子项目之一，用于检测服务器的状态。
在lvs体系中，Keepalived主要有如下3个功能：
1 管理LVS负载均衡软件
2 实现对LVS集群节点的健康检查功能
3 作为系统网络服务的高可用功能
即 Keepalived 实现了 heartbeat + ldirectord 的功能
原理
Layer3,4,5工作在IP/TCP协议栈的IP层，TCP层，及应用层,原理分别如下：
Keepalived使用Layer3的方式工作式时，Keepalived会定期向服务器群中的服务器发送一个ICMP的数据包（既我们平时用的Ping程序）,如果发现某台服务的IP地址没有激活，Keepalived便报告这台服务器失效，并将它从服务器群中剔除，这种情况的典型例子是某台服务器被非法关机。Layer3的方式是以服务器的IP地址是否有效作为服务器工作正常与否的标准。
实验三：高可用集群High-Avaliability
实验环境:
server1：MASTER机
server4：BACKUP机
server2：Real server机1
server3：Real server机2
配置步骤
1、用server1做lvs负载均衡的DR模式

[root@server1 ~]# ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 52:54:00:c4:21:a9 brd ff:ff:ff:ff:ff:ff
    inet 172.25.29.1/24 brd 172.25.29.255 scope global eth0
    inet 172.25.254.100/24 scope global eth0
    inet6 fe80::5054:ff:fec4:21a9/64 scope link 
       valid_lft forever preferred_lft forever
       [root@server1 ~]# ipvsadm -A -t 172.25.254.100:80 -s rr
[root@server1 ~]# ipvsadm -a -t 172.25.254.100:80 -r 172.25.29.2:80 -g
[root@server1 ~]# ipvsadm -a -t 172.25.254.100:80 -r 172.25.29.3:80 -g
[root@server1 ~]# ipvsadm -L
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
  -> RemoteAddress:Port           Forward Weight ActiveConn InActConn
TCP  172.25.254.100:http rr
  -> server2:http                 Route   1      0          0         
  -> server3:http                 Route   1      0          0         
[root@server1 ~]#

2、server2和server3做Read server配置

[root@server2 ~]# ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 52:54:00:50:62:94 brd ff:ff:ff:ff:ff:ff
    inet 172.25.29.2/24 brd 172.25.29.255 scope global eth0
    inet 172.25.254.100/32 scope global eth0
    inet6 fe80::5054:ff:fe50:6294/64 scope link 
       valid_lft forever preferred_lft forever
[root@server2 ~]# arptables -A IN -d 172.25.254.100 -j DROP
[root@server2 ~]# arptables -A OUT -s 172.25.254.100 -j mangle-ip-s 172.25.29.2
Bad argument `172.25.29.2'
Try `arptables -h' or 'arptables --help' for more information.
[root@server2 ~]# arptables -A OUT -s 172.25.254.100 -j mangle --mangle-ip-s 172.25.29.2
[root@server2 ~]# arptavles -L
-bash: arptavles: command not found
[root@server2 ~]# arptables -L
Chain IN (policy ACCEPT)
target     source-ip            destination-ip       source-hw          destination-hw     hlen   op         hrd        pro       
DROP       anywhere             172.25.254.100       anywhere           anywhere           any    any        any        any       
DROP       anywhere             172.25.254.100       anywhere           anywhere           any    any        any        any       

Chain OUT (policy ACCEPT)
target     source-ip            destination-ip       source-hw          destination-hw     hlen   op         hrd        pro       
mangle     172.25.254.100       anywhere             anywhere           anywhere           any    any        any        any       --mangle-ip-s server2 

mangle     172.25.254.100       anywhere             anywhere           anywhere           any    any        any        any       --mangle-ip-s server2 

Chain FORWARD (policy ACCEPT)
target     source-ip            destination-ip       source-hw          destination-hw     hlen   op         hrd        pro       
[root@server2 ~]# 
[root@server2 ~]# /etc/init.d/arptables_jf save
Saving current rules to /etc/sysconfig/arptables:          [  OK  ]
[root@server2 ~]# 

server1配置(先删掉之前做DR模式给它指定的vip，因为keepalived配置文件会自动分配vip)
1、下载keepalived软件包

---

注意：compile报错时，解决依赖性， 安装 openssl-devel

---

[root@server1 ~]# yum install openssl-devel.x86_64 -y

3、配置keepalived服务

---

/etc/keepalived/keepalived.conf

global_defs {
   notification_email {
     root@localhost
   }
   notification_email_from keepalived@localhost
   smtp_server 127.0.0.1
   smtp_connect_timeout 30
   router_id LVS_DEVEL
   vrrp_skip_check_adv_addr
   #vrrp_strict
   vrrp_garp_interval 0
   vrrp_gna_interval 0
}

vrrp_instance VI_1 {
    state MASTER
    interface eth0
    virtual_router_id 29
    priority 100
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass 1111
    }
    virtual_ipaddress {
        172.25.254.100
    }
}

virtual_server 172.25.254.100 80 {
    delay_loop 3
    lb_algo rr
    lb_kind DR
    #persistence_timeout 50
    protocol TCP

    real_server 172.25.29.2 80 {
        weight 1
        SSL_GET {
            connect_timeout 3
            retry 3
            delay_before_retry 3
        }
    }
    real_server 172.25.29.3 80 {
        weight 1
        SSL_GET {
            connect_timeout 3
            retry 3
            delay_before_retry 3
    }
    }
}

server4
在server4上安装gcc ipvsadm openssl-devel等依赖包

[root@server4 ~]# yum install ipvsadm gcc openssl-devel httpd -y

1、将server1中的/usr/local/keepalived目录直接复制到server4中

[root@server1 keepalived]# scp -r /usr/local/keepalived/ server4:/usr/local/

2、在server4中创建软链接并给server4加入ipvsadm策略

---

3、将server1中的配置文件复制到server4中

[root@server1 keepalived]# scp /etc/keepalived/keepalived.conf server4:/etc/keepalived/
root@server4's password: 
keepalived.conf                                                100% 1055     1.0KB/s   00:00    
[root@server1 keepalived]#

4、修改server4配置文件
server4配置文件和server1差不多，只需要改两行即可

---

server1和server4配置成功
1、开启server1和server4的keepalived

---

测试：
配置成功后，我们用物理机访问vip，访问结果为server2和server3轮询，且arp指向server1的物理地址，当server1的kp关闭后，物理机访问，轮询依旧正常，不过arp指向了server4的物理地址，所以说在主机出现故障时，备机能迅速代替工作，当server1开启kp后，物理机访问arp指向server1的物理地址，则表示当主机恢复正常后，主机会马上接管vip，从而实现双机热备高可用

---